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1 A. Yes. 

2 Os Are you opining that Dr. Wright manipulated 

3 any documents? 

4 A. Same answer. 

5 OC: And by "Same answer" you mean everything we 


6 discussed with regards to the other question would apply 


7 by switching -- modified, manipulated you'll have the 


8 same answer; correct? 

9 MR. ROCHE: Objection, form. Dr. Edman, just 
10 to the extent you can answer the question I would 
14 just instruct you to answer the question as opposed 
12 to referring back to your last answer. 


13 BY MR. KASS 

14 0. I'll re-ask the question and then we'll see 

iS how Dr. Edman does it. Are you opining that Dr. Wright 
16 has manipulated any documents? 

17 A. I am opining that a number of documents were 
18 manipulated in a manner that would be consistent with 

19 the defendant having performed those manipulations. 

20 Q. Are you opining that it in fact was Dr. Wright 
21 who made those manipulations? 

22 A. I don't believe that's explicitly stated in my 
23 report but the implication suggests that it would be 

24 consistent with the defendant having performed those 


25 manipulations. 
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1 Oi. Right but that's not your actual final 

2 conclusion; correct? 

3 MR. ROCHE: Objection, form. 

4 THE WITNESS: Can you restate the question? 

5 BY MR. KASS 

6 0; Sure. I believe you stated the implication 


7 was that it was Dr. Wright who made those modifications 
8 but do you actually conclude that it in fact was 

9 Dr. Wright who made those modifications? 

10 A. Again I don't believe in my report I conclude 
alma decisively that it was Dr. Wright who made the 

12 modifications but the implication is that the 

13 modifications are consistent with the defendant having 
14 done them. 

15 J. And that would be your same opinion at trial; 


16 correct? 


18 ep Are you opining that Dr. Wright has altered 

gS) any documents? 

20 A. Again I don't believe that's stated explicitly 
21 in my report but the implication is clear that the 

22 modifications would be consistent or alterations would 
23 be consistent with the defendant having performed that. 
24 oF But you're not actually opining that it was 


25 Dr. Wright in fact who made those alterations; correct? 
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A. Yes, I don't believe I explicitly state so in 
my report. 

Or And that would be your same opinion at trial; 
Correct? 

A. Yes. 

0. Are you opining that Dr. Wright has done 


anything to make certain documents unauthentic? 

MR. ROCHE: Repeat that. I didn't hear the 

end of the question. 
BY MR. KASS 

Oo. Are you opining that Dr. Wright has done 
anything to make certain documents unauthentic? 

A. Again I don't believe I explicitly state that 
in the report. 

Oi. Will you -- but will you be opining that it in 
fact was Dr. Wright who made the documents unauthentic? 

MR. ROCHE: Objection, form. 

THE WITNESS: Again I don't believe I stated 
that explicitly in my report but the implication 
the evidence suggests the alterations to make the 
documents unauthentic would be consistent with the 
defendant having performed. 

BY MR. KASS 
oe Is that going to be your same opinion at 


trial? 
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1 A. Yes. 

2 oF When you say an alteration -- let me back up. 

3 I just used four different synonyms; modified, 


4 manipulated, altered, unauthentic. So is there one word 
5 you feel comfortable using that kind of encompasses all 


6 four just to kind of simplify this a little bit? 


7 MR. ROCHE: Objection, form. 

8 MR. KASS: I am just trying to make the 

9 deposition easier. I don't mind having to repeat 
10 my questions four times. 
11 MR. ROCHE: Dr. Edman, to the extent you -- 
alge you think you can consolidate it like that without 
13 losing any accuracy in your answers I'm fine with 
14 that. 

15 THE WITNESS: If you want to use manipulation 
16 as a common term for those synonyms for purposes of 
17 this deposition I'm fine with that. 


18 BY MR. KASS 

19 Q. And we'll even make it a little more narrow. 
20 Let's just say for the next few questions and then I'll 
24 let you know when we're not going to use that any more. 
22 My next couple minutes of testimony we're going to refer 
23 to manipulation; correct, is that the word you like to 
24 use? 


25 A. Sure. 
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1 O. When you stated that these manipulations were 


2 consistent with having been made by Dr. Wright what do 
3 you mean by consistent? 

4 A. I mean that the evidence available to me 

5 suggests that defendants would have at least had the 

6 means to create those manipulations. 

7 Q. Could those manipulations also have been 

8 consistent with other people having made them? 

9 A. The evidence available to me doesn't suggest 
10 anyone else having created those manipulations. 
14 ee So are you opining that Dr. Wright is the only 
alge person who is consistent with having made those 


13 manipulations? 


14 MR. ROCHE: Objection, form. 

15 THE WITNESS: Based on the evidence available 
16 to me it appears that -- at least I don't have 

17 anyone else who would be consistent with performing 
18 those manipulations. 


19 BY MR. KASS 

20 O. So do you have an opinion as to whether it was 
ad likely that Dr. Wright made those manipulations? 

22 A. Can you be more specific on what you mean by 
23 likely? 

24 0. Right. Before you said it's consistent. The 


25 way I understand consistent it could be consistent with 
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1 Dr. Wright. It could also be consistent -- let's just 


2 back up. What's your basis for stating that those 

3 manipulations are consistent with having been done by 
4 Dr. Wright? 

5 A. The basis as stated in my report but in 

6 general includes accounts associated with Dr. Wright, 
z computers and IP addresses associated with Dr. Wright. 
8 Certain metadata that references the defendant. There 
9 may be other things cited in my report that I don't 
10 recall as I sit here right now but high level review. 
17 0. That's fine. Going with the high level 
12 overview with the understanding that there may be some 
13 other things you're also relying on. My question is 
14 conceivably there could be other people consistent who 
15 possibly have access to accounts, same IP address area 
16 that could also have been behind these manipulations. 


Ly Do you agree with that premise? 


18 MR. ROCHE: Objection, form. 
19 THE WITNESS: Anything is possible but I don't 
20 have evidence available to me to support that. 


21 BY MR. KASS 

22 Q. Right. So based on that lack of evidence do 
23 you believe it's likely that Dr. Wright was the person 
24 behind the manipulations? 


25 MR. ROCHE: Objection, form. 
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1 THE WITNESS: I don't have any evidence to 

2 suggest someone other than Dr. Wright performed 

3 those manipulations. 

4 BY MR. KASS 

5 OC: So is it your opinion that all the evidence 


6 suggests that Dr. Wright made those manipulations? 

7 A. Again that's my opinion that the manipulations 
8 are consistent with Dr. Wright -- 

9 0. And the only person you're aware of that was 
10 consistent -- that fits the consistency of having made 


17 those manipulations is Dr. Wright? 


12 A To the best of my knowledge, yes. 

13 Q. Is that going to be your opinion at trial? 

14 A Yes. 

15 oP Are you going to be providing an opinion as to 


16 whether Dr. Wright is a forgerrer? 

17 MR. ROCHE: Objection, form. 

18 THE WITNESS: Could you be more specific? 

19 BY MR. KASS 

20 OC. Sure. Are you going to be giving an opinion 
ad. as to whether Dr. Wright has forged any documents? 

22 A. Again my opinion is that the manipulations 

23 that I observed are consistent with the defendant having 
24 made them. 


25 oe Are you going to be -- just to clarify now as 
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1 far as I'm going away from the manipulations meaning 

2 those four different words so now I am going to be using 
2 more specific terms going forward. You understand that? 
4 A. Yes. 

5 0. Okay. Are you going to be providing an 


6 opinion that Dr. Wright in fact forged documents? 


7 MR. ROCHE: Objection. Seems like we're 

8 splicing words here Zalman. To the extent you want 
9 to define what you mean by these words that might 
10 be. == 
11 MR. KASS: I'm using the word forged which he 
alge uses in his report. I think that's fair game. 
13 We'll get to asking what his definition of forgery 
14 is but now I'm using a word that's in his report. 
15 Dr. Edman, however you understand forgery to mean 
16 that's my question. 
1? THE WITNESS: Okay. Could you please restate 
18 the question? 


19 BY MR. KASS 
20 CO. Sure. Are you giving any opinion that Dr. 


ad Wright forged documents? 


22 A. Again that's my opinion that forgeries were at 
23 least consistent with the defendant having created them. 
24 O. Are you opining that it was Dr. Wright in fact 


25 who made that forgery? 
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1 report? 

2 A. I don't recall the exact date. Probably early 
3 March, late February perhaps. 

4 QO; And your prior reports, do you recall when you 
5 had written those? 

6 A. Late 2019, early 2020. 

7 OC. So is it fair to say about three months give 

8 or take? 

9 MR. ROCHE: Objection to form. 
10 THE WITNESS: Can you restate the question? 
LA. BY MR. KASS 
12 Q. Sure. Between when you wrote your first two 
13 reports which are Exhibit 1 and 2 and when you rehashed 
14 the documents about two to three months had passed? 
15 A. I think that's fair to say. 
16 Q. And is it also accurate to say that you don't 
17 in fact have a list of the actual hash values that you 


18 generated for Exhibits 1 and 2? 


19 A. I don't believe that's entirely accurate. 
20 OC. What part of it is accurate? 
21 A. We had previously provided to you a list of 


22 hashes associated with certain files that were provided 
23 by plaintiff's E-discovery vendor which I understand was 
24 as provided by your E-discovery vendor. 


25 OQ. Okay. Is there anything else? 
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1 A. No, not as I sit here today. 
2 O. So as far as the actual hash values that you 


3 generated when you were analyzing those documents we 

4 don't have an actual list of the hashes that you 

5 generated? 

6 A. The hashes are the documents that I analyzed 
7 are in Exhibit 3. 

8 OC: Right. But the actual hashes that you 

9 generated at the time of your analysis are not saved? 
10 A. For one and two. For three obviously it's 


11 recorded and saved in that report. 


12 MR. KASS: Okay. That works. Kyle, we can 

13 take a break. You want to take a ten minute break? 
14 MR. ROCHE: Sure, sounds good. 

15 THE WITNESS: Do I just mute? 

16 MR. KASS: Just mute. You can stop your 

17 video. I'll leave the meeting running. 


18 BY MR. KASS 

gS) O. Dr. Edman, do you remember testifying earlier 
20 on today that certain alterations, modification, 

21 forgeries or changes to documents are consistent with 
22 having been done by Dr. Craig Wright? Sorry, didn't 

23 Catch that? 

24 A. Yes. 


25 0. You also testified that he is the only person 
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1 that you're aware of consistent with having done those 

2 actions? 

2 A. COEFECE, 

4 0; What have you done to determine whether other 
5 people -- whether those actions would also be consistent 
6 with other people? 

7 A. I've simply reviewed the other documents that 
8 are available to me. 

9 Oo; The documents that are available to you are 

10 what? 

17 A. Listed in my report. At least that I have 

12 reviewed. 

13 MR. KASS: Just Dr. Edman, I'm not sure if 

14 you're aware -- you're good, nevermind. Strike 

15 that. I'm going to introduce as Exhibit number 4 a 
16 document, Excel that is titled Dr. Edman Relativity 
17 Documents and has a date of February 3rd 2020. 

18 (Defendant's Exhibit No. 4 was 

19 marked for identification. ) 
20 MR. ROCHE: Zalman, are you representing that 
eal this is the same document we produced to you? 
22 MR. KASS: Yes, that you had sent me by 
23 e-mail, correct. Let me ask you to send it -- I'm 
24 going to unscreen share and I'm going to drop it 
25 into the chat box so everybody has a copy. 
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1 MR. ROCHE: Would you mind doing that for 
2 every document that you introduce as opposed to 


3 dropping it in the box? 
4 MR. KASS: Did you get it because I got a 


5 weird message? Wait a second. I am going to 


6 resend it. I don't know if it's the size but for 
7 some reason it's not letting me do it. I can 

8 e-mail it to you if you want. 

9 MR. ROCHE: Yes, that would be helpful. 

10 MR. KASS: Sure. Going to send it to you 


of right now. 


12 MR. ROCHE: I'm going to forward it on to Dr. 
13 Edman. You can e-mail it to him too. 

14 MR. KASS: I think I may know what the problem 
Ls is. Give me one second, let me try something. It 


16 wouldn't let me share because it was opened. Now 


17 it's in the chatbox so you could have it. 

18 MR. ROCHE: Got it. 

cg THE WITNESS: This is Exhibit 4? 

20 MR. KASS: Yes. I'm going to do a screen 

eal share. 

22 THE WITNESS: Apologies, just for consistency 
23 with my numbering do you anticipate there being 


24 more than 100 exhibits? 


25 MR. KASS: No, I do not. 
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1 0. Now I just want to understand a little bit 
2 more as to the structure of your report and just I want 
3 to try and summarize it and then just let me know if 
4 it's accurate or if you want to make any changes. The 
5 way I understand your report to work is that you'll 
6 start off with a Roman numeral number and a header of a 
z Bates number of a certain document and I understand that 
8 to be the document that you're going to be analyzing in 
9 that section. Is that correct? 
10 A. Yes, I believe that's generally the structure. 
11 Q. And then if we scroll down until the next 
12 Roman numeral header there is generally going to be a 
13 last paragraph in this particular case on page number 
14 three it is going to be paragraph number six and it says 
LS accordingly and it gives an opinion; is that correct? 
16 A. Yes. 
Ly Os So and in this particular case it's your 
18 opinion that the document's not authentic and it has 
19 been manipulated? Sorry, are you waiting for me? 
20 A. My apologies, I don't believe you asked a 
21 question. 
22 Q. I'm sorry. My question was is it your opinion 
23 that -- your opinion in paragraph six is that the 
24 document is not an authentic invoice but instead has 


25 been manipulated; correct? 
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1 A. COrrece., 

2 (i. And so is it fair to say that all the 

3 paragraphs between the Roman numeral header and your 

4 conclusion which is the last paragraph of that section 


5 is the basis and the facts that support your conclusion? 


6 A. In the section, yes. 

7 CO. That's generally throughout your report? 

8 A. That is generally throughout my reports. 

9 0. Are you relying -- throughout your report are 


10 you relying on any bases that are not identified in 

11 those paragraphs? 

12 A. No. 

13 Oi, Dr. Edman, do you recall providing an opinion 


14 that certain documents are forgeries? 


15 A. Yes. 

16 0. What does a forgery mean to you? 

17 MR. ROCHE: Objection, asked and answered. 

18 THE WITNESS: Again forgery to me is a 

19 document that has been manipulated to appear to be 
20 something other than what it actually is. 


21 BY MR. KASS 

22 O% So what's the difference between a forgery and 
23 a manipulated document? 

24 MR. ROCHE: Objection, form. 


25 THE WITNESS: I believe that we had previously 
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a agreed that they were all synonyms. 
2 BY MR. KASS 
3 Q. Well, I just wanted to make sure that was 


4 actually your opinion. It appears like it is? 

5 A. Yes, my opinion forgery is a document that has 
6 been manipulated to appear to be something other than 

7 what it is thus it's a manipulated document. 

8 OC; If a document was manipulated but you don't 

9 know what the intention was can that document be a 


10 forgery? 


it MR. ROCHE: Objection. 

12 THE WITNESS: Again as we discussed previously 
13 I don't opine on the reason for any of these 

14 manipulations or at least the ultimate purpose of 
15 the manipulated documented. 


16 BY MR. KASS 

Ly O; Here is my question. My understanding of what 
18 you just testified is that a forgery is when a document 
19 has been manipulated to appear to be something than what 


20 it actually is. Is that accurate? 


21 A. I agree with your definition. 
22 Oz So it seems to me that there is some sort of 
23 intent because you're opining when something is forged 


24 that somebody was trying to make this look like it was 


25 something else, correct? 
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al A. Correct. The document was changed but as for 
2 why specifically that document was changed for example 
3 an e-mail from 2014 to 2011 I don't generally opine on 
4 why this specific date that was chosen. 

5 OG: Let me ask you. If I have an invoice -- this 
6 is a hypothetical I'm being very clear. If I have an 

7 invoice that I prepared yesterday and I was planning on 
8 sending it to a third party and I didn't get around to 
9 it I'm going to send it today so I changed the date, I 
10 went into PDF I used the text editor, I changed 
11 yesterday's date to today's date and then I sent it out. 


12 Would you agree that document has been manipulated? 


13 A. Yes. 

14 OC. Has it been altered? 

15 A. Yes. 

16 Q. Has it been modified? 

17 A. Yes. 

18 OG: Has it been forged? 

19 A. Based on your hypothetical the description it 


20 was an invoice dated yesterday that was made to look 
ad. like an invoice dated today so in some sense you could 
22 consider that a forgery. 

23 Or. Would you consider it a forgery? 

24 A. I think it depends on the context in your 


25 hypothetical but based on the definitions we've agreed 











U.S. LEGAL SUPPORT 
www.uslegalsupport.com 


Case 9:18-cv-80176-BB Document 500-3, Entgred.on FLSD Docket 05/09/2020 Page 18 of 57 
April 29, 2020 58 





al on I believe that would be a forgery. 
2 ss When you used the word forgery throughout your 
3 report are you using that type of understanding of the 
4 word forgery? 
5 A. Again I used that term to refer to a document 
6 that's been manipulated to appear to be something other 
¢ than what it is. 
8 ©; So if we were to apply that to my hypothetical 
9 the forgery is because I'm making it appear as if it was 
10 actually sent today -- sent today but really I did it 
11 yesterday and I updated the date? 
12 A. Again I would need to see this hypothetical 
13 document how these modifications were made but again 
14 12'S Se 
15 oe We can do it right now if you want. I can do 
16 a screen share and modify a PDF right in front of you if 
Ly that's necessary. I don't believe it is, right? My 
18 question is I don't understand -- you can give me the 
19 scenarios in one situation where you would call ita 
20 forgery and one where you wouldn't. I just don't 
21 understand where the doubt is. 
22 A. Sorry, could you restate the question? 
23 0. Sure. We have my hypothetical I drafted the 
24 invoice yesterday. Today I went into the PDF I changed 


25 the date with the text editor, PDF text editor, and sent 
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i it out. I had asked you is that a forgery and I'm not 


2 sure I got a totally clear answer. What would your 
3 answer be in that situation? 
4 A. If it were in your hypothetical example a 


5 document that let's say an invoice in your hypothetical 
6 example that were created yesterday. 

7 Q. Yes. 

8 A. And you modified or manipulated that document 


9 to make it appear as if it were an invoice created 


10 today. 
11 Q. Correct. 
12 A. By the literal definition you could consider 


13 that are a forgery. 


14 GC. Would it matter what my intentions were? 

15 A It may. 

16 Q. In what sense? 

17 A I take that back. The literal definition I 
18 think your intentions are irrelevant to your 

9 hypothetical. It's still an invoice that was created 


20 yesterday and then modified to make it look as if it 


ea were created today. 


22 Os So your definition that's a forgery? 
23 A. For the purposes of this hypothetical, yes. 
24 Q. Now, what if I created an invoice and I wrote 


25 that my total fees were $100 and made it into PDF $100, 
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Al wrote it today today's date. Then I realized afterwards 
2 I made a mistake. It really should have only been $75 

3 so I go back into the PDF, I change the PDF to make it 

4 $75 so actually reflects the work that I did. I send 

5 out that invoice. Is that a forgery? 

6 A. I mean again by the literal definition that 

7 we're using for the purpose of these hypotheticals you 

8 could consider it a forgery. It was an invoice for $100 
9 that was made to look like the invoice for $75. 
10 ©. It doesn't matter to you that actually the 
14 first invoice was incorrect and by making this 


12 alteration I actually made the document accurate? 


13 MR. ROCHE: Objection, form. 

14 THE WITNESS: I don't see why you couldn't 
15 simply regenerate the invoice. 

16 MR. KASS: I'm lazy, right. 


17 BY MR. KASS 


18 OC: Hypothetically. 

19 A. You're hypothetically lazy? 

20 Q Yes. 

val A Okay. Can you restate the question? 

22 CO. Sure. You stated that you don't see why 

23 someone could have regenerated the invoice. Let me ask 


24 you. If I were to regenerate the invoice with the right 


25 amount then it would not be a forgery; correct? 
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al A. Correct. The document was not manipulated. 
2 oF But if I were to use a PDF editor to change 


3 the $100 to be $75 then it would be a forgery? 
4 A. For purposes of this hypothetical based on the 
5 definitions we've discussed it would be an invoice for 
6 an amount other than what it was intended to be. 
7 OC. And the definitions we discussed for forgery 
8 those are the same definitions that you used throughout 
9 your three reports which are Exhibit 1, 2 and 3; 
10 COrrect? 
11 MR. ROCHE: Objection, form. 
i2 THE WITNESS: In general yes, I believe so. 
13 BY MR. KASS 
14 0. Is there any time when you're not using that 
15 definition? 
16 A. Not that I recall but I don't recall each and 
17 every paragraph of my reports as I sit here today. 
18 OC. My other question for you is going through 
19 your reports sometimes you state that it's a forgery, 
20 sometimes you state that it's manipulated and sometimes 


ZA. that it was not authentic. Do you agree you change 


22 your -- the verbiage you use in your conclusions? 
23 A. Yes, though the implication is consistent. 
24 0. So in your mind it doesn't matter which 


25 verbiage you use, you could have used manipulated 
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al throughout and that wouldn't have changed your opinion? 
2 A. COPRrecr., 
3 Or Let me ask you a question, a new hypothetical. 
4 This time I'm talking about Word, not talking about -- 
5 this is a hypothetical where I'm using a Word document. 
6 I draft my invoice. I put the $100 on it and I hit 
7 save. I close the Word document. I reopen the Word 
8 document then I realize no it should have been 75. 
9 Reopen the Word document and I change it to $75. Is 
10 that a forgery? 
algal A. In the hypothetical it seems like your 
12 original document was a draft and you modified your 
13 drat t.. 
14 O:. Why do you state that it seems like my 
15 document was a draft? 
16 A. Maybe I missed that part of your hypothetical. 
17 It sounded like you drafted a new invoice, saved it, 
18 closed it, opened it, updated your draft and then 
19 created your invoice based on the document. Is that 
20 accurate? 
21 Oo. Well, yes, I didn't define it as draft but the 
22 actual mechanics you got correct. So let me ask you a 
23 different question. So is it your opinion that once the 
24 document's PDF'd then it comes final or is a final Word 


25 document? 











U.S. LEGAL SUPPORT 
www.uslegalsupport.com 


Case 9:18-cv-80176-BB Document 500-3, Entgred.on FLSD. Docket 05/09/2020 Page 23 of 57 





April 29, 2020 63 
a A. I mean I imagine you can have final Word 
2 document. 
2 iO: So I would modify my hypothetical that I 


4 create my invoice, made it $100, I saved it. I even put 
5 final in the file name. Saved it. Invoice, final, 

6 closed it. Ten minutes later I realized it should be 

7 $75 I opened it back up I modified it to $75, is that 


8 document a forgery now? 


9 A. The literal definition I suppose so. 
10 O. Okay. Now another hypothetical. 
17 A. Are you okay, Zalman? 
12 MR. KASS: Just give me a second. It's hot in 
13 here. Give me like two minutes. Let's take a two 
14 minute break, Kyle. 
15 MR. ROCHE: Let's take a five minute break. 
16 MR. KASS: Five minute break, okay. 
17 (Thereupon, a brief recess was taken.) 


18 BY MR. KASS 

19 ©. Dr. Edman, one more hypothetical. I opena 

20 Word document. I put it in the invoice that the amount 
a4 is going to be $100. Then I don't even close the Word 
22 document, I don't save it. Right after I typed it where 
23 I wrote 100 I said no, it actually should be 75. TI just 
24 delete it, click the 100, put in the 75 is that a 


25 document a forgery? 
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1 A. In your hypothetical it seems like you are 
2 still in the process of drafting the document. 
3 Q. And therefore? 
4 A. The document isn't complete and you are simply 


5 drafting it and I don't believe that based on the 

6 definitions we've discussed that would be considered 

7 forgery. 

8 0: So if I'm still in the process of drafting 

9 then it's not a forgery; is that accurate? 

10 A. Yes. You're at the time still drafting the 

11 document . 

alge Or. How do you determine whether someone is still 
13 drafting the document? 

14 A. If it's saved, it's transmitted seems like -- 
LS depending on the context that could indicate that the 

16 document is finalized or the representation is made 

17 about the document that could influence whether it's a 
18 draft or not one way or another. 

19 O. Dr. Edman, do you have an opinion as to 
20 whether it is appropriate to rely on a forged document? 
ad A. That's a very general question. I think in 
22 general it's probably not reasonable to rely on a forged 
23 document but I think it would depend on the context that 
24 you're -- you have in mind here. 


25 Q. Well, let's go back to -- in what context 
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1 reference the instance -- scrap this. Would you write 
2 in your opinion that you did an analysis of the document 
3 ID? 
4 A. I apologize, that was a very confusing 


5 question. Could you restate it? 

6 O: Yes. Give me one second. Let me think about 
7 a better way to do this. Okay. I have a much easier 

8 way to do this. Okay. Document, human readable text 

9 says the date on the top of the document human readable 
10 text says January 1, 2020. You look at the date 

im modified, date created January 1st 2020. But in touch 
12 up text edits you see a different part of the document 
13 was changed. In that situation what would you list in 
14 your report? 

15 A. I think it would depend on the specific 

16 document. Again if you want to point me if you have 

Ly questions about specific documents and artifacts that I 
18 include or did not include in my report I'm happy to 

i3 address those. 

20 Q. We'll definitely get to specific documents. I 
24 want to understand your methodology how you would go 

22 about it. 

23 A. Looking at the specific document. 

24 oF Well, I gave you a specific hypothetical 


25 document; correct? 
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al A. Yes. So then again I would want to review 
2 that specific hypothetical document. 

3 Os So you can't state without looking at the 
4 document what your methodology would be; is that 


5 accurate? 


6 MR. ROCHE: Objection, form. 
7 THE WITNESS: My methodology at a high level 
8 would be what's described in my report. 


9 BY MR. KASS 


10 0. Which part of your report? 
14 A. The methodology section in my December 2018. 
12 Q. Possibly 2019, Exhibit 1, is that what you're 


13 referring to? 


14 A. Yes, Exhibit 1, my apologies. 

15 Q That's fine. 

16 A. Did I say 2017? 

17 Ox I think you said '18. 

18 A My apologies, 2019. 

19 ©; I'm going to actually do a screen share and we 


20 can go through it together. Now, I'm looking at your -- 
21 here it says on page six is your methodology. So you 

22 have two paragraphs that -- is it accurate to state that 
23 paragraphs 16 and 17 state your methodology? 

24 A. Yes, those paragraphs outline the methodology 


25 that I applied for reviewing the various documents 
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i analyzed and described in my report. 


2 O. In paragraph 16 you state that generally 

3 comprises the following components; correct? 

4 A. Yes. 

5 Q. That reviewing the human readable context and 
6 then you analyzed internal machine readable code or 
structure and then you identify extracting metadata 


8 about the documents; correct? 

9 A. Correct. 
10 GO: But you don't specify in particularity what 
11 artifacts you considered; correct? 
a Be A. This is a high level methodology that I 

13 applied to the various types of files that I reviewed. 
14 The specific artifacts depend on the particular type of 
15 file being reviewed. 

16 Q. I want to know if there is any specific 


17 guidelines you can give me for when you will consider 


18 certain artifact a certain types of documents? 

19 MR. ROCHE: Objection, asked and answered. 

20 THE WITNESS: I consider -- I consider 

21 whatever artifacts are available within that 

22 document which may include mail transport headers, 
23 time stamps within those headers, time stamps 

24 within certain metadata. In your hypothetical 

25 example I would consider document ID. Does that 
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a answer your question? 
2 BY MR. KASS 
3 Q. That answers part of my question. I guess my 
4 question is though is it -- is it a set methodology or 


5 process that you do for every document or sit more I 
6 look at the document and then I decide how I want to 


7 approach it, that's what I'm trying to understand? 


8 MR. ROCHE: Objection, form. 

9 THE WITNESS: Yes, in general there is a set 
10 methodology. Not all artifacts within a particular 
11 document necessarily are interesting though. 

12 Because again going back to an example you 

13 discussed earlier not every single time stamp say 
14 for example in the mail transport header is 

15 noteworthy for describing or listing in the report. 
16 They're in the documents cited in my report 

17 but not necessarily, you know, explicitly stated or 
18 written out or listed in the report. 


19 BY MR. KASS 

20 Q. Would that be because that metadata is not 
val necessarily consistent with the document having been 
22 manipulated or altered? 

23 A. I don't think that's necessarily true. 

24 oe So are you stating that there are additional 


25 alterations or modifications that you found on these 
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a documents but you didn't list because they weren't 


2 interesting? 

3 MR. ROCHE: Objection, form. 

4 THE WITNESS: I don't believe that's what I'm 
5 stating. 


6 BY MR. KASS 


7 CO. So could you clarify what you are stating? 
8 A. Could you clarify your question? 
9 Oo: Sure. My question is -- give me one second. 


10 Let me try to formulate it. 


11 MR. ROCHE: Zalman, it's 12:30 so -- 

alge MR. KASS: I think give me five more minutes 
13 and I think I'll wrap up with this. 

14 MR. ROCHE: Good. 


15 BY MR. KASS 

16 CO. Going back to my hypothetical there is a 

17 document there's create date, modify date consistent 

18 with the human readable date on the document. You found 
gS) touch up text edits that relate to different parts of 

20 Ehe. documents. 

24 In your report would you only list the touch 
22 up text edits or also note the modified date, create 

23 date and note that it was consistent with the human 

24 readable date? 


25 A. Again I think it depends on the specific 
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al documents. I mean if the touch up text edits were for 

2 example in your hypothetical indicated that the human 

2 readable date was modified to be consistent with the 

4 metadata dates then I may list both in my report. 

5 OC: What if the touch up text edit only indicates 
6 that signature line was changed and the portion that is 
z the signature not the date related to the signature 

8 line, what would you list in your report? 

9 A. Again I think it would depend on the specific 
10 document. 

1 J. So is it fair to state that you cannot give me 
12 a clear methodology -- a clear outline of your 
13 methodology without reviewing a specific document? 
14 A. My methodology is listed in paragraphs 16 and 
15 17 of my 2019 report which is a high level approach to 
16 analyzing the variety of types of documents. Specific 
Ly artifacts that I reviewed and the methods for extracting 
18 them are listed -- the methods are listed in my report. 
19 The artifacts that I looked at varied 
20 depending on the type of document and whether those 
21 artifacts are present and whether other artifacts within 
22 the document suggest we're looking at other sources of 
23 information. 
24 J. So however, the specifics as to your -- would 


25 you agree the specific way you implement your 
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1 methodology is not outlined in your report? 


2 MR. ROCHE: Objection, form. 

2 THE WITNESS: No, my methodology at a high 

4 level for conducting analysis of these files is 

5 listed on my 2019 report. Further details are also 
6 listed in the report. 


7 BY MR. KASS 

8 ©: Those further details are as you apply 

9 methodology to specific documents; correct? 

10 A. Sorry, could you restate that? 

11 Os Sure. You state that you have a high level 
12 methodology in your report which is Exhibit 1 in 

13 paragraph 16 and 17; correct? 

14 A. Yes, and that methodology is applicable to a 
cS variety of file types. 

16 0. But as far as a detailed methodology that -- I 
Ly believe you're stating is stated in this specific bases 
18 for your opinions throughout the report; is that 

19 accurate? 
20 A. The specific methodology if you're referring 
ZA. to for example tools used? 
22 Q. Yes. Or artifacts. 
23 A. To extract certain artifacts is listed in my 
24 report. Whether a specific artifact is written out in 


25 my report again I don't explicitly include each and 
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1 every time stamp contained within each and every file. 
2 I include the ones that are interesting, relevant to my 
2 opinion and indicating that the document has been 

4 manipulated. 

5 0. And would that apply to the other artifacts in 
6 addition to time stamps? 

7 A. I believe that's what I just answered that a 
8 review artifacts including time stamps within these 

9 documents. But not necessarily each and every time 
10 stamp contained within a file referenced in my report 
it would be copied into my report because the example 
12 e-mail file could have a dozen time stamps not all of 
is which are relevant to my analysis. 
14 Or. Right. So is it fair to say you included all 
15 the artifacts that you deem were relevant and supported 
16 your conclusion in your report? 
17 A. If an artifact were relevant to my conclusion 


18 then I would include it in the report. If there were 


19 artifacts that -- I'll leave it there. 
20 Q. My only question is and this may just be a 
21 semantics issue I want to make sure we're on the same 


22 page. When you say relevant does that mean supportive 
23 of your opinion? 
24 A. Yes, relevant and ones that are contradictory 


25 to -- so for example if there are two time stamps in the 
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1 report again this depends on the specific file if you 
2 want to discuss specific files I'm happy to but say 

3 there is a discrepancy between time stamp unless certain 
4 files I would likely note that as an indicator or as a 
5 potential indicator this document has been manipulated. 
6 O; And the flip side if those time stamps are 

7 consistent then you wouldn't note that? 

8 A. It depends on which specific time stamps and 
9 which specific document you're talking about. There 
10 could be multiple time stamps within a file that are 
im) consistent with each other that I wouldn't necessarily 
2 list each and every one. 
13 Q. And there could also be artifacts that are 
14 consistent with the human readable text that you also 


15 wouldn't note; correct? 


16 A. Again it depends on the particular file. 

17 MR. KASS: Kyle, I think that's it. Want to 
18 take an hour break? What works for everybody? 

19 Whatever. 

20 MR. ROCHE: Let's come back at 1:20. 

21 MR. KASS: Sure, that works. 

22 MR. ROCHE: Great. 

23 MR. KASS: See you all then. 

24 (Thereupon, a brief lunch recess was taken.) 
25 
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1 (Defendant's Exhibit Nos. 7 & 8 were 

2 marked for identification. ) 

3 MR. KASS: I am going to drop into the chat 

4 box Exhibit 7, Exhibit 8 and I'm going to describe 

5 them. So Exhibit 7 is what appears to be Dr. 

6 Edman's invoice from February 3, 2020 and Exhibit 8 

z is what appears to be Dr. Edman's invoice from 

8 April 14, 2020. 

9 BY MR. KASS 

10 Q. Dr. Edman, have you received those two files? 

11 A. Yes, I have them. 

12 Q. Now, I want to look at the one that's titled 


13 EX791653 and it's dated February 3rd 2020. You see 


14 that? 
15 A. Yes. 
16 C5 We're going to call that Exhibit 7. What does 


17 this invoice reflect? 

18 A. The invoice reflects amounts due to BRG from 
19 Boies, Schiller. 

20 O. And those amounts are due to BRG due to your 


21 work on this case? 


22 A. Yes. 

23 Q And the total amount is $10,864? 

24 A. For professional services. 

25 Q Correct. Then there is additional expenses of 
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al about three-and-a-half thousand give or take? 

2 A. Yes. 

3 0% Now I'm going to go to document which I've 

4 marked as Exhibit 8 and what does this document reflect? 
5 A. Again this is an invoice to Boies, Schiller 


6 for my work on this case. 


7 CO. How much is for professional services? 
8 A. S35 ,6072 5 
9 OC: And this relates to the drafting of your most 


10 recent report which is Exhibit 3? 

11 A. Yes. 

12 0. If you go to the third page of the -- page 
13 three of four there is a description under the time 
14 entries, under the description entry. You see that? 
15 A. Yes. 

16 G: Is that an accurate reflection of the work 
Ly that you did in those time periods? 

18 A. Yes, I believe so. 

19 Q. Dr. Edman, do you recall before the lunch 
20 break we were talking about different artifacts that you 
21 consider? 

22 A. Yes. 

23 0. Do you place any weight -- do you place 

24 different weights to those different artifacts? 


25 A. You have to be more specific. 
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al Q. Are some of the artifacts more determinative 
2 of a document being forged, altered or manipulated? 

3 A. Not necessarily. I think it would depend on 
4 the specific artifact of the document. 

5 Q. What do you mean it would depend on the 

6 specific artifact of the document? 

7 A. I think it depends exactly what I said which 


8 artifact and which document you're talking about. 
g i. As a general rule you can't tell me whether 
10 one of those 16 are very strong indicators and one 


alta possibly being weaker, it really just depends on the 


12 Situation? 

Re A. Yes. I think it depends on the situation. 
14 GC. Have you tried to replicate your findings? 
IS A. Yes. 

16 oe How have you done that? 

LF A. By repeating my analysis. 

18 ie So let me ask you. There is a document that 


LS you found there was a touch up text edit; right, 


20 hypothetical document? Do you understand that premise? 


21 A. Yes. 
22 ie Based upon the touch up text edits you 
23 determined that certain parts of the document has been 


24 manipulated; yes? 


25 A. In general, yes. 
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1 0. How do you replicate that touch up text edit? 
2 A. I don't understand your question. 
3 Or Well, you said -- you stated you replicated 


4 your results; correct? 

5 A. I think we were talking about two different 

6 things here. Can you be more specific? 

7 Q. Sure. When I asked you if you replicate your 


8 results what does that mean to you? 


9 A. That means that I have reviewed the documents 
10 listed in my report in the secret environments and 
algal confirmed my previous results are consistent. 
12 Or. Did you -- did you -- so is it fair to say 


13 that based on certain artifacts you determine there to 
14 be a manipulation; correct, in general? 

15 A. In general, yes. 

16 CG. Did you then take a PDF and do those 

17 manipulations you believe occurred to see if it results 


18 in same artifacts? 


Le A. No. 
20 Q. Have you done any error rate testing? 
21 A. I don't know what you're talking about in this 


22 context. 
23 O. Well, do you know if 100 percent of the time 
24 that someone does a touch up text edit it's going to 


25 result in a modification? 
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al MR. ROCHE: Objection, form. 
2 THE WITNESS: That's my understanding of how 
3 the software works. I don't understand there's any 
4 probability associated with it such that only a 
5 percentage of the time would the software create a 
6 touch up text in the marker. 
7 BY MR. KASS 
8 Q. Have you tested to find out if it's 


9 100 percent or different percentage? 
10 A. No, based on my experience though if the 
14 document's modified there is a touch up text edit marker 
alge assuming that the documents in question was a PDF and 


13 was modified using Adobe Acrobat's text edit tool. 


14 O. Has anybody reviewed your work? 

15 A. I believe so. 

16 OC. Who? 

17 A. I believe you hired multiple experts to review 


19 Q. Has anybody in BRG reviewed your work? 

20 A. No, not to my knowledge. At least not with 

21 respect to this case. 

22 O% Have you shown your work to any other person 
23 who you consider to be an expert in this field to review 
24 your work? 


25 A. No. 
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ab OC. Do you have any understanding as to whether 
2 touch up text edits are accepted in the forensic 
3 industry as being reliable? 
4 A. I have no reason to think otherwise. It's 


5 certainly something that I've encountered before 

6 reviewing other matters. 

Oi. But do you know of any courts that have 

8 accepted touch up text edits as a reliable indicator of 
9 a document modification? 
10 A. I can't say. I don't know. 
Ll Q. Have you ever submitted any report to a Court 


12 that they relied on touch up text edits as a reliable 


13 indicator of modifications? 

14 A. Outside of this case? 

15 QO Yes. 

16 A. Outside of this case, no. 

LF Q Are you aware of any studies that consider 
18 touch up text edits as an indicator of modifications? 
a) A. Not off the top of my head. 

20 oe Are you aware of any books that address that 


a type of modification? 

22 A. It's my understanding the Adobe Acrobat 
23 specification may reference more content points. 
24 Whether it addresses touch up text edit markers in 


25 particular I don't recall. I don't believe so. 
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al OC. What's your understanding how touch up text 

2 edits markers are created? 

2 A. My understanding is that the Adobe software 

4 inserts the marker into the document where the document 
5 is modified using the Adobe text edit tool. 

6 Oo; Is that limited to certain versions of the 

7 software? 

8 A. It may be. 

9 Q. Well, do you know which versions of the 


10 software do create that marker? 


11 A. No, I don't have an exhaustive list of which 
12 software versions create that marker. 

13 Ors Do you know of any list that's not exhaustive? 
14 A. No. 

15 0. How do you know that edits with Adobe's text 


16 editor creates a touch up text marker? 

17 A. Because in the context we used patterns seen 
18 PDF documents that were modified that contain the same 
Le marker. 

20 Q. Did you open up the Adobe text editor making 
21 an edit in the document to confirm that it left that 
22 marker? 

23 A. Not in the context of this case. I may have 
24 at a previous point in time but I didn't do that for 


25 this matter. 











U.S. LEGAL SUPPORT 
www.uslegalsupport.com 


Case 9:18-cv-80176-BB Document 500-3, Entgred.on FLSD. Docket 05/09/2020 Page 41 of 57 





April 29, 2020 98 
al 0. Would you agree that the metadata and PDF is 
2 malleable? 
3 A. Yes: 
4 QO. And that people co go into the object code or 


5 behind the human readable code and make edits? 

6 A. Yes. 

7 OC. And sometimes you've determined that you're 

8 able to identify those edits; correct? 

a A. Yes. 

10 O. Could it be possible that edits were made that 
all you were unable to identify? 

12 A. I would say that's possible. 

13 Os So if the document create date says 

14 hypothetically January 1st 2020 doesn't necessarily mean 
15 the document was created on January lst 2020; correct? 
16 A. That alone maybe. I think it would depend on 
Ly specific documents. If there are other artifacts within 
18 that document. 
19 Q. You would look to see if there's some sort of 
20 corroborating evidence in the document or corroborating 
21 artifact; is that fair to say? 
22 A. Corroborating or some evidence that disputes 
23 that date. 
24 i. Do you consider lie detection to be within 


25 your area of expertise? 
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1 to. Bitcoin, mining? 
2 A. I don't. 
3 Q. Do you know how this document is related to 


4 the ownership of Bitcoin? 

5 A. T don’ t.. 

6 O; Do you know how this document is related to a 
7 partnership between Dave Kleiman and Dr. Wright? 

8 A. ET don’t < 

9 CO. Do you know how your testimony as to this 
10 document is going to be helpful to the jury? 
11 A. I don't know. 
12 Q. To the extent modifications were made to this 


13 document what's your opinion as to when the 


14 modifications were made? 
15 A. I believe the modifications were made in 2014. 
16 Q. On page six of your report you reference a 


17 document that is under Roman numeral 5 DEFAUS underscore 


18 00519695. Do you see that? 


19 A. Yes. 

20 MR. KASS: I am going to introduce that as 
21 Exhibit 14. 

22 (Defendant's Exhibit No. 14 was 

23 marked for identification. ) 


24 BY MR. KASS 


25 OQ. Have you received the document? 
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1 A. Yes. 
2 Oi. Do you know what this document -- what 
2 connection this document has to the development of 


4 intellectual property? 


5 A. No. May I ask one clarifying question though? 
6 0: Sure... 
7 A. The document cited in my report that I 


8 analyzed I don't believe carried the footers shown in 

9 the documents you've sent me. 

10 0. What do you mean by the footers? 

17 A. They reference the Bates number in the lower 
12 right, confidential in the lower left and then a CW for 
13 example Exhibit 14 CW.001.008.3165. I don't believe 

14 those were in the native documents that I analyzed. 

15 oP That's correct because inherently the native 
16 documents are not going to have the Bates stamp numbers 
17 on it. They're done after it's kind of imaged -- when 
18 it's imaged it's put the Bates stamps. So considering 
gS) when I'm asking the document I mean the version of the 
20 native document that you looked at, not specifically the 
val PDF as represented here. Does that make sense? 
22 A. You're representing to me that the documents 
23 that you're sending me the Bates number corresponds to 
24 native document that I analyzed? 


25 Q. It should be, correct. To the extent you have 
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1 a native document of it. What happens is in your report 
2 you reference a document by Bates number we pull it. 

2 Sometimes there is another native version that would 

4 have the Bates stamp and we pull the version that has 

5 the Bates stamp on it. Kyle, are fine with that? Just 
6 want to make sure. 

7 MR. ROCHE: So the only question is there 

8 seems to be two different Bates stamps an extra 

9 Bates stamp on the document. So what is that extra 
10 Bates stamp? 

14 MR. KASS: Honestly I'm not sure. I didn't 

alge pull it from there. I don't know -- it could be 

13 sometimes documents are produced I know like 

14 sometimes when stuff like the confidential stuff 

15 then we reproduce sometimes you'll end up having 

16 cross referenced Bates numbers. I don't know the 
Ly exact history of it. This is a representation of 
18 the document he saw it may not have the Bates stamp 
19 6m at. 
20 MR. ROCHE: Understood. 
ad. MR. KASS: Are we all on the same page? I 
22 don't want to later on be some sort of confusion. 
23 MR. ROCHE: No. You're making a 
24 representation that any -- that the Bates stamp 
25 located on the document corresponds to the Bates 
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1 stamp cited in his report? 
2 MR. KASS: Exactly, yes. 
3 MR. ROCHE: Okay. Then as long as we have 
4 that representation we're good. 
5 BY MR. KASS 
6 Oo. With that clarification Dr. Edman, do you have 


7 an understanding as to whether this document is related 
8 to the development of intellectual property? 
9 A. I don't and my apologies for the earlier 
10 digression. 
14 i. That's fine. If you need clarification that's 
12 totally okay. Do you have any understanding as to 
13 whether this document is related to Bitcoin mining? 
14 A. I don't know. 
15 Oi. Do you know if this document has any 
16 relationship to the ownership of Bitcoin? 
17 A. I don't know. 
18 Oo; Do you know if this document has any 
19 relationship to a partnership between Dave Kleiman and 
20 Dr. Wright? 
ad. A. I don't know. 
22 Or To the extent this document was altered what's 
23 your opinion as to when that alteration took place? 
24 A. I think the document was modified in 2014. 


25 Q. Now, I am going to turn to page seven of your 











U.S. LEGAL SUPPORT 
www.uslegalsupport.com 


Case 9:18-cv-80176-BB Document 500-3, Entgred.on FLSD. Docket 05/09/2020 Page 46 of 57 
April 29, 2020 159 





1 development or ownership of intellectual property? 

2 A. No. 

3 O's Do you know how this document relates to a 

4 purported partnership between Dave Kleiman and Dr. 

5 Wright? 

6 A. No. 

7 CO. Do you know how your testimony will be helpful 


8 to the jury? 


9 A. L don't. 
10 MR. ROCHE: Just as to that question? 
1d MR. KASS: Yes. 


12 BY MR. KASS 
13 On. To the extent modifications were made what is 
14 your testimony as to the date -- what is your opinion as 


15 to the date the modifications were made? 


16 A. The modifications appear to have been made in 
17 2014. 

18 MR. KASS: Kyle, I think I need five minutes 
19 to just to go through my notes to make sure I 

20 didn't miss anything and just have a short 

21 continuation after that if possible. Does that 

22 work. 

23 MR. ROCHE: All right. Sounds good. 

24 (Thereupon, a brief recess was taken.) 

25 
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1 BY MR. KASS 

2 a Dr. Edman, throughout your three reports you 
2 testified as to the IP addresses associated with certain 
4 actions. Is that fair to say? 

5 MR. ROCHE: Objection to form. 

6 THE WITNESS: Yes. 

7 BY MR. KASS 

8 OC Did you consider that a VPN was used when 

9 those actions were taken? 

10 A. Yes. 

14 MR. ROCHE: Lack of foundation. 

12 BY MR. KASS 
13 Q. And how did you consider the possibility that 
14 a VPN was used? 
15 A. So for at least the Max Mind exhibits that I 
16 produced those typically identify when an IP address is 
Ly associated with a VPN or some sort of itemizer. That 
18 doesn't appear to be the case. 
19 O When do you mean -- when you say that 
20 typically list does that mean sometimes they don't? 
21 A. I don't believe it's possible for a database 
22 like Max Mind to identify each and every proxy VPN or 
23 Max Mind for the exhibit. 
24 0. Did you also consider that IP addresses are 


25 not static? 
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1 A. Could you be more specific? 
2 oP Sure. Is the same IP address always assigned 


3 to the same physical location? 

4 A. I'm not your question is exactly technically 
5 accurate. 

6 ae Let me ask you let me see if I can ask it a 
z different way. I'm sitting in my house right now I'm 
8 hooked up in the computer I presume there's an IP 


9 address associated with my computer, correct? 


10 A. Probably. 

14 J. Is there also one associated with my router? 
12 A. Probably. 

13 0. And presumably if we go to Max Mind and we put 
14 in the IP address of my router it would show somewhere 


15 in Florida; correct? 

16 A. Probably. 

17 QO; Has this IP address always been assigned to my 
18 router? 

19 A. I don't know. 

20 Q. Well, typically is the same IP address always 


val assigned to the same router? 


22 A. I can't speak to your home internet 
23 connection. 
24 J. I'm just asking you as someone who I 


25 understand has deep expertise in internet security and 
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1 specific IP addresses. I believe you do have a lot of 

2 expertise in this. I'm just asking you as a general 

3 rule how does it work as far as IP addresses being 

4 assigned to specific devices? 

5 A. It depends on the particular provider. 

6 Certain types of services give you a static IP address 

7 which doesn't change. Others provide you a dynamic 

8 address which could change. Not guaranteed to be the 

9 same but doesn't necessarily mean that it changes. 
10 Q. So if it's a static IP address and I just 
17 purchased a new router -- I just moved into a new home I 
12 just purchased a new router. They're going to assign me 


13 a static IP address; correct? 


14 A. I don't know. That would depend on your 
15 service agreement with your internet service provider. 
16 Q. But in order to get online I will need an IP 


17 address, do we agree with that at least? 


18 A. Yes, most likely. 

19 OG. And that IP address is going to come from 

20 somewhere? 

21 MR. ROCHE: Objection to form. 

22 THE WITNESS: It could be an IP address 

23 assigned by your internet service provider or it 

24 could be one you entered yourself. Depends on your 
25 home network configuration. 
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1 BY MR. KASS 
2 Q. Now, is that IP address created new for me or 
3 could it be recycled from somebody else? 
4 A. It could be recycled from someone else 
5 previously. 
6 Q. And could that someone else previously have 
y lived somewhere else other than Florida? 
8 A. In the realm of anything's possible sure. 
9 O:. Are you saying it's more probable they lived 
10 in Florida previously? 
aa A. Again this is very much depends on the 
12 specifics of your internet service provider but in 


12 general I would think that that IP address is more 
14 likely if it were previously assigned to someone would 


15 be previously assigned to someone in similar geographic 


16 region as you. 

17 Q. And that's -- what's the basis for that 

18 opinion or understanding? 

19 A. My experience. 

20 O. Now, let me ask you. What do you know about 


an Dr. Craig Wright's ISP or internet provider? 

22 A. I would say I don't know the specifics of his 
23 internet service provider or his relationship with that 
24 provider. 


25 oF Do you know if that provider used static or 
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a dynamic IP addresses? 

2 A. I don't know. 

3 Or. If it was -- it's possible that he got a 

4 recycled IP address; is that fair enough? 

5 A. Again I think I would need more specifics. 

6 Can you be more specific in your question? 

7 Q. Sure. So the IP addresses that are associated 
8 with the documents you've looked at, do you know if 

9 those IP addresses were created specifically for 
10 Dr. Craig Wright? 
11 A. I don't know. 
12 Q. Now, when you're looking at the Max Mind and 
13 it's telling you the geographic location of those IP 
14 addresses what timeframe is Max Mind referring to? 
15 A. Max Mind is referring to my understanding is 
16 it's referring the timeframe of when I performed the 
17 look up. 
18 OC. Is it fair to say it's sometime in 2019 or 


19 2020; correct? 


20 A. Yes. 
ZA. 0; So do you have any basis to state what 
22 location those IP addresses were associated with at the 


23 time you believe the documents were manipulated or 
24 modified? 


25 A. Yes. 
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1 0. What's your basis? 
2 A. My basis is I also have other documents or 


2 other e-mails identified in my third report that are 

4 associated with the same IP address and in my experience 
5 look ups from Max Mind while they may not necessarily 

6 provide an exact latitude and longitude of the device or 
z the computer or the user associated with the IP address 
8 in general the geographic region didn't change 

9 Significantly over time. 
10 Oo, And that's the same even if six years have 
17 passed? 
12 A. That's at least been my experience. 
13 Q. How many times have you looked into Max Mind 
14 and checked over time as to the movement of an IP 


15 address? 


16 MR. ROCHE: Objection, form. 
Ly THE WITNESS: I believe it's come up in a few 
18 cases before. 


19 BY MR. KASS 


20 Q. How many cases? 

ad. A. I don't know the exact number. 

22 Q. Do you know if it's between -- 

23 MR. ROCHE: Do you want to take a break? 

24 THE WITNESS: I think we are good. 

25 MR. KASS: Give me a minute. One second. I 
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1 think I got it. Give me one second. Give me a one 
2 minute break. 
3 MR. ROCHE: Take a minute break. 
4 (Thereupon, a brief recess was taken.) 
5 BY MR. KASS 
6 ©. Dr. Edman, when you state that you've done it 
7 before -- when you state you've done it before do you 


8 have an approximation as to how many times you've done 


9 it? 
10 A. Could you please restate the question? 
14 i. Yes. I believe I asked you how many times 


12 have you look at Max Mind to see how IP address 

13 locations change over time and I believe you stated 

14 you've done it a number of times in the past. Does that 
15 sound accurate? 

16 A. Yes. In general I believe it could be more 

Ly accurately characterized as this -- I've looked into 

18 this issue on previous cases before. 

gS) 0: Have you found any authoritative source that 
20 discusses how Max Mind -- sorry, let me back up. Strike 
21 that. Isn't Max Mind a directory that shows where IP 

22 addresses are assigned, their geographic location; is 

23 that accurate? 

24 A. Max Mind is a database that associates a 


25 geographic location with an IP address or range of IP 
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ab addresses. 
2 Q. But the actual IP address is assigned by the 
3 internet service provider or as you said many 


4 possibilities; correct? 

5 A. Yes. 

6 Q. So it's possible that if you look on Max Mind 
and you look at my IP provider maybe they're always 

8 assigning it to the same area but a different internet 


g provider could be using IP addresses from all over the 


10 country or globally; correct? 

al A. I don't think I understand your question. 

12 Q. Sure. My understanding of your testimony is 
13 that Max Mind -- is that the geographic locations of IP 


14 addresses normally stay in the same geographic region; 
IS SCOrrect? 

16 A. Yes. 

17 0. And that's based on your prior use of Max 

18 Mind; correct? 

19 A. Yes. 

20 O. But my question is wouldn't it depend on who 
21 the internet provider of the IP addresses are that 

22 you're looking up on Max Mind? 

23 A. i'm Sure that's a Tactor. 

24 Q. Have you ever looked -- had a case where you 


25 were looking up IP addresses that currently are 
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1 associated with Australia? 

2 A. I don't believe so. I don't recall every IP 

2 address that I've ever looked up and I can't say whether 
4 every IP address I've ever looked up is currently 

5 associated with Australia according to Max Mind. 

6 ap Do you understand how Max Mind determines the 
7 location of an IP address? 

8 A. I think exactly how they do that is a 

9 proprietary algorithm but my understanding is they 

10 aggregate information from a number of sources including 
ald the providers. 

alge Oi But again that's all information related to 

13 the current geographic location? 

14 A. COrrece. 

15 oF And do you have any information as to who was 
16 the internet service provider of the IP addresses you 

17 looked at in the timeframe of 2013, '14 or '15? 

18 A. I'm sorry, are you asking if I know who the 

19 internet service provider associated with the IP address 
20 as identified in our report was in 2014 or '15? 
21 Q. Correct. 
22 A. I don't believe I have that information. I 
23 just have what Max Mind provided me. 
24 OD. And do you know who assigned those IP 


25 addresses that you note in your report in the years that 
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a you note that? 
2 A. I don't know specifically who assigned those 
3 IP addresses. 
4 O; Dr. Edman, you have various opinions related 


5 to the times certain events occurred? 


6 MR. ROCHE: Objection, form. 
7 MR. KASS: I could be more specific if you 
8 want. Just trying to keep it -- 


9 BY MR. KASS 
10 Oo. Your opinion sometimes you state this document 
17 was sent the exact same time as another document. Does 
12 that sound familiar? 
13 A. Yes. 
14 O-. Do you know what time that document was 
15 actually sent? 
16 A. I'm sorry, which document specifically are you 
17 talking about? 
18 OG: We could find one in your report if you would 
gS) like but I'm saying generally when you use that phrase 
20 are you stating that that's the time when it was 
val actually sent or that's the time that the metadata 
22 shows, just wondering what your opinion was? 
23 A. It depends on the specific document. In the 
24 context of e-mails it would be the time that was shown 


25 in the metadata. 
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1 O. Now, does the time that was shown in the 

2 metadata always reflect the time the sender clicks send? 

2 A. Not necessarily. 

4 O; In what situation would it not reflect the 

5 time that the sender clicked send? 

6 A. If it could reflect a different time if the 

7 time on the computer that was used to send the e-mail 

8 were manipulated. 

9 Oo; Could it also be if the sender of the e-mail 
10 didn't have internet connection, he click send, he was 
11 on an airplane, he landed, he got Wi-Fi and sent the 
12 e-mail when he connected to Wi-Fi? 

13 A. I suppose that would depend on the particular 
14 e-mail client used to send the e-mail. 

15 oP Is that because depending on the client some 
16 clients will time stamp it when the button sent is 

17 clicked while other ones will time stamp it based on 

18 when it leaves the inbox? 

19 A. Presumably. 

20 O. Have you done any analysis as to what client 


ZA. was used when the e-mails were sent that you analyzed? 


22 A. Are you asking if I did any analysis to 
23 identify which e-mail clients were used? 

24 Q. Yes. 

25 A. Or if I analyzed the e-mail clients 
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